Data Augmentation To the best of our knowledge,  [1]} first draw the conclusion that the effect of backdoor attack depends heavily on the position and the appearance of triggers. They proposed the spatial transformation-based defense, which modifies the location of the trigger on images, including horizontal flipping and padding after shrinking on the original image. [2]}, [3]}, [4]} further performed more comprehensive data augmentations and validated the efficacy of them in centralized classification models. In our setting, we apply two kinds of data augmentation. Given the backdoor attack is sensitive to the location of the trigger as indicated by [1]}, we perform the random horizontal flipping on inputs before being fed into the FedGAN in the first experiment. In the second experiment, random rotation is applied. Each image will be randomly rotated within the range of \((-90, 90)\)  and then fed into the FedGAN.
